On Mon, Jan 28, 2013 at 08:48:55PM -0500, Mimi Zohar wrote: [..] > > Hi Mimi, > > > > By policy you mean ima rules here? So I can either enable default rules > > (tcb default rules for appraisal and measurement) by using kernel command > > line options or dynamically configure my own rules using /sysfs interface? > > > > If yes, AFAIK, existing inputtable policies do not allow this selective > > mode where we do appraisal only on signed executable. That means I shall > > have to extend the way policies can be specified so that one specify > > that appraise only signed files? > > We've just added the ability of defining the method for appraising a > file and defining rules in terms of the filesystem UUID. Extending the > IMA policy shouldn't be a problem, but I'm not sure how you would go > about adding support for only appraising files with digital signatures. Hi Mimi, Can we add another field to ima_rule_entry, say .enforcement to control the behavior of .action. Possible values of .enforcement could be, say. ALL SIGNED_ONLY ALL will be default. And with .action= MEASURE, one could possibly use .enforcement=SIGNED_ONLY. Thanks Vivek -- To unsubscribe from this list: send the line "unsubscribe linux-crypto" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
